#!/usr/bin/env node
/**
 * Local web host for the vendored Codex webview.
 *
 * `original/` stays byte-identical — every adaptation happens in the HTTP
 * response layer, so the vendored tree remains a clean reference.
 *
 * The desktop renderer is not a plain web app; three pieces of the Electron
 * shell are load-bearing and are replaced here:
 *
 *   1. CSP. The shipped policy is `default-src 'none'` with a connect-src that
 *      only whitelists `wss://chatgpt.com`. A browser tab could not reach
 *      anything, and we do not want it to: the policy is rewritten to `'self'`
 *      so the page is fully local.
 *   2. The app host. `connect-app-host` creates a MessageChannel and posts one
 *      port to the preload, which hands it to the main process. Here the port is
 *      never used: `__codexLocalHost` answers instead (host/local-host.js).
 *   3. Host services. The bootstrap awaits `appHost.services`, which the main
 *      process resolves with its service layer. Our local host resolves it with
 *      a proxy onto the real `codex app-server` (host/app-server-bridge.mjs).
 *
 * Usage:
 *   node host/web-server.mjs [--port 8095] [--root original]
 */

import { execFileSync } from "node:child_process";
import fs from "node:fs";
import http from "node:http";
import path from "node:path";
import { fileURLToPath } from "node:url";

import { AppServerBridge } from "./app-server-bridge.mjs";
import { serveMockRelay } from "./mock-model.mjs";
import { createProjectlessPaths, readWorkspaceRoot, WORKSPACE_ROOT } from "./projectless.mjs";

const HERE = path.dirname(fileURLToPath(import.meta.url));
const PROJECT = path.resolve(HERE, "..");

const argv = process.argv.slice(2);
const argOf = (name, fallback) => {
  const i = argv.indexOf(name);
  return i !== -1 && argv[i + 1] ? argv[i + 1] : fallback;
};
const PORT = Number(argOf("--port", process.env.CODEX_WEB_PORT || "8095"));
// --root wins; otherwise CODEX_UI_ORIGINAL_ROOT (set by scripts/run-codex-ui.sh),
// otherwise the in-repo `original/` directory (never committed — see §4).
const ROOT = path.resolve(PROJECT, argOf("--root", process.env.CODEX_UI_ORIGINAL_ROOT || "original"));

if (!fs.existsSync(path.join(ROOT, "index.html"))) {
  console.error(`[web] missing index.html under ${ROOT}`);
  process.exit(1);
}

const METHODS = JSON.parse(fs.readFileSync(path.join(HERE, "appserver-methods.json"), "utf8"));
const bridge = new AppServerBridge();

// --------------------------------------------------------------- CSP rewrite
// Fully local: nothing outside this origin is reachable. Blob/data stay allowed
// because the app builds workers and assets in memory.
const WEB_CSP = [
  "default-src 'self'",
  "img-src 'self' data: blob:",
  "script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' blob:",
  "style-src 'self' 'unsafe-inline'",
  "font-src 'self' data:",
  "connect-src 'self' data: blob:",
  "media-src 'self' data: blob:",
  "worker-src 'self' blob:",
  "frame-src 'self' blob:",
  "child-src 'self' blob:",
].join("; ");

const MIME = {
  ".html": "text/html; charset=utf-8",
  ".js": "text/javascript; charset=utf-8",
  ".mjs": "text/javascript; charset=utf-8",
  ".css": "text/css; charset=utf-8",
  ".json": "application/json; charset=utf-8",
  ".svg": "image/svg+xml",
  ".png": "image/png",
  ".jpg": "image/jpeg",
  ".jpeg": "image/jpeg",
  ".webp": "image/webp",
  ".gif": "image/gif",
  ".ico": "image/x-icon",
  ".woff": "font/woff",
  ".woff2": "font/woff2",
  ".ttf": "font/ttf",
  ".otf": "font/otf",
  ".wasm": "application/wasm",
  ".map": "application/json; charset=utf-8",
  ".txt": "text/plain; charset=utf-8",
  ".wav": "audio/wav",
  ".mp3": "audio/mpeg",
};

/** Rewrite rules applied on the fly; `original/` on disk is never touched. */
const JS_PATCHES = [
  {
    name: "local-app-host",
    // `connect-app-host` opens a MessageChannel and posts one port to the
    // preload, which forwards it to the Electron main process. There is no main
    // process here, so answer with the local host instead.
    find: /function (\w+)\((\w+)\)\{let\{port1:(\w+),port2:(\w+)\}=new MessageChannel;return window\.postMessage\(\{type:`connect-app-host`/g,
    replace: (_m, fn, arg, p1, p2) =>
      `function ${fn}(${arg}){if(globalThis.__codexLocalHost)return globalThis.__codexLocalHost(${arg});` +
      `let{port1:${p1},port2:${p2}}=new MessageChannel;return window.postMessage({type:\`connect-app-host\``,
  },
  {
    name: "bootstrap-guard",
    // The original bootstrap wires up seven main-process facilities: remote
    // connection discovery, an execution host, an RPC-broken hook, thread read
    // state, Statsig, client coordination and the terminal. Only the first two
    // affect the shell; the rest are Electron-only and would abort the whole
    // sequence on the first rejection. Keep the parts that matter, guard them,
    // and drop the rest.
    find: /async function pL\(\)\{[\s\S]*?\}function mL\(\)/g,
    replace: () =>
      `async function pL(){` +
      `const T=(ms)=>new Promise(r=>setTimeout(r,ms));` +
      `const guard=async(f,ms)=>{try{return await Promise.race([f(),T(ms)])}catch(e){console.warn("[codex-web] init step skipped:",e&&e.message)}};` +
      `await guard(async()=>{$t(kS(lL))},5000);` +
      `await guard(async()=>{dr(await Pt.services)},10000);` +
      `await guard(async()=>{await ql(H.remoteConnections)},2000);` +
      `await guard(async()=>{di(await H.executionHosts?.getDefaultHost())},2000);` +
      `globalThis.__codexBootstrapped=!0` +
      `}function mL()`,
  },
  {
    name: "skip-shell-gate",
    // The shell waits for auth, app-info, os-info and one more readiness signal
    // before rendering anything. In the desktop app the main process supplies
    // all four; here auth in particular only settles after the app server has
    // been asked for an account, which cannot happen until the shell exists.
    // Render the shell immediately and let the data arrive underneath it.
    find: /if\((\w+)\.isLoading\|\|(\w+)\|\|(\w+)\|\|(\w+)\)\{/g,
    replace: (_m, r, a, s, c) =>
      `if(console.info("[codex-web] shell gate",JSON.stringify({rLoad:${r}&&${r}.isLoading,a:${a},s:${s},c:${c}})),!1){`,
  },
  {
    name: "mode-probe",
    // `Ck` picks the window mode (`app` / `onboarding` / `login`) from a pile of
    // readiness signals and falls back to the loading blossom when it comes back
    // empty. The guard is a comma expression inside a single `if`, so the anchor
    // is the tail of that expression rather than the `if(` itself. Log the
    // decision so the missing input is identifiable.
    find: /,!(\w+)\|\|(\w+)===\x60loading\x60\)\{/g,
    replace: (_m, mode, status) =>
      `,console.info("[codex-web] mode",JSON.stringify({mode:${mode},status:${status}})),!${mode}||${status}===\x60loading\x60){`,
  },
  {
    name: "mode-inputs",
    // Bind the mode-input object to the global scope on its way into the
    // decision function, so a probe can read exactly what the shell decided on.
    find: /,(\w+)=(\w+)\(\{bedrockLoginPending:/g,
    replace: (_m, out, fn) => `,${out}=${fn}(globalThis.__modeIn={bedrockLoginPending:`,
  },
  {
    name: "mode-decide",
    // The window-mode decision gates on two desktop-only concepts:
    //
    //   gatewayOAuthReadiness — an OpenAI gateway handshake that stays `loading`
    //     forever here because there is no gateway: this build talks to an
    //     API-key relay, so there is nothing to wait for.
    //   onboarding completion — the desktop onboarding flow needs a ChatGPT
    //     account and a backend, neither of which this build has.
    //
    // Collapse both: honour an explicit "login required", otherwise go straight
    // to the app. The relay authenticates with a key, so there is no login step.
    find: /(\w+)===\x60loading\x60\?null:\1===\x60required\x60\?\x60login\x60:[\s\S]{0,200}?:\x60welcome\x60\):\x60app\x60\}/g,
    replace: (_m, readiness) =>
      `${readiness}===\x60required\x60?\x60login\x60:\x60app\x60:\x60app\x60}`,
  },
  {
    name: "config-effective-preseed",
    // The scope-query bridge fetches only from mounted React readers. In a
    // browser fallback nothing mounts the config/effective query, so `ofo()`
    // would read `isPending: true` forever and keep `isAgentModeLoading` true.
    // Short-circuit to the preseeded app-server config (host/shim.js).
    find: /let\{data:(\w+),isPending:(\w+)\}=ixn\((\w+)===`~`\?null:\3,(\w+)\),/,
    replace: (_m, w, T, p, C) =>
      `let{data:${w},isPending:${T}}=globalThis.__codexCfg?{data:{config:globalThis.__codexCfg.config,origins:globalThis.__codexCfg.origins??{},layers:null},isPending:!1}:(ixn(${p}===\`~\`?null:${p},${C}),{data:void 0,isPending:!0}),`,
  },
  {
    name: "permission-profiles-preseed",
    // Same mount requirement for the permission-profiles query read inside the
    // agent-mode hook (`sfo`); short-circuit to the preseeded profile list.
    find: /let (\w+)=ns\(kdo,(\w+),(\w+)\),(\w+)=\w+\|\|\w+\|\|\1\.isPending,(\w+)=\4\|\|\1\.isError,/,
    replace: (_m, O, T2, D2, k, A) =>
      `let ${O}=globalThis.__codexPerms?{data:globalThis.__codexPerms,isPending:!1,isError:!1}:ns(kdo,${T2},${D2}),${k}=h||g||${O}.isPending,${A}=${k}||${O}.isError,`,
  },
  {
    name: "guardian-off",
    // The guardian-approvals feature flag derives from a Statsig dynamic
    // config the desktop main process evaluates; with a null evaluations
    // payload (this build has no ChatGPT account) the guard reads as
    // "unavailable" and `ofo()` treats guardian mode as pending forever.
    // This build has no guardian capability at all, so pin it off.
    find: /N=(\w+)&&oee\(\w+\?\?void 0\)!==!1&&\(\w+===void 0\|\|\w+\),/,
    replace: (_m, e) => `N=!1,`,
  },
  {
    name: "statsig-bootstrap-local",
    // The renderer fetches its Statsig bootstrap from the ChatGPT backend
    // (`POST /wham/statsig/bootstrap`). Without a ChatGPT token that request
    // is rejected before it is ever sent, and the SDK retries forever with
    // "SDK initialization has not completed" warnings. Serve the bootstrap
    // from the local host instead (see /__codex_statsig_bootstrap).
    find: /function (\w+)\((\w+),(\w+)\)\{return (\w+)\.safePost\(`\/wham\/statsig\/bootstrap`,\{requestBody:\2,retry:!1,signal:\3\}\)\}/g,
    replace: (_m, fn, reqBody, signal) =>
      `async function ${fn}(${reqBody},${signal}){` +
      `const r=await fetch("/__codex_statsig_bootstrap",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(${reqBody}??{}),signal:${signal}});` +
      `return r.json()}`,
  },
  {
    name: "expose-app-host",
    // setAppHost / setAppServices only assign module-scoped variables, which
    // makes the wiring invisible from the outside. Mirror them for diagnostics.
    find: /function hSt\((\w+)\)\{_St=\1\}/g,
    replace: (_m, v) => `function hSt(${v}){_St=${v};globalThis.__appHost=${v}}`,
  },
  {
    name: "expose-app-services",
    find: /function gSt\((\w+)\)\{f\$=\1\}/g,
    replace: (_m, v) => `function gSt(${v}){f$=${v};globalThis.__appServices=${v}}`,
  },
];

function patchJs(source) {
  let out = source;
  const applied = [];
  for (const rule of JS_PATCHES) {
    if (!rule.find.test(out)) continue;
    rule.find.lastIndex = 0;
    out = out.replace(rule.find, rule.replace);
    applied.push(rule.name);
  }
  return { out, applied };
}

function patchHtml(source) {
  let out = source;

  out = out.replace(
    /<meta http-equiv="Content-Security-Policy" content="[\s\S]*?"\s*\/?>/i,
    `<meta http-equiv="Content-Security-Policy" content="${WEB_CSP.replace(/"/g, "&quot;")}" />`,
  );

  // Both shims must run before the module entry.
  if (!out.includes("__codex_shim.js")) {
    out = out.replace(
      /<script type="module"/i,
      `<script src="/__codex_local_host.js"></script>\n    <script src="/__codex_shim.js"></script>\n    <script type="module"`,
    );
  }
  return out;
}

const LOCAL_HOST_JS = fs
  .readFileSync(path.join(HERE, "local-host.js"), "utf8")
  .replace("/*@METHODS@*/ []", JSON.stringify(METHODS));

const SHIM = fs.readFileSync(path.join(HERE, "shim.js"), "utf8");
// ------------------------------------------------------------- mock backend
// Local stand-in for the ChatGPT backend. The app server runs with
// chatgpt_base_url pointed at /mock, so every call that would reach OpenAI's
// cloud — plugin catalog refresh, account endpoints, telemetry — is answered
// from this process with well-formed local JSON. Nothing leaves the machine
// and no caller ever sees a connection error.
const MOCK_LOG = [];
const nowIso = () => new Date().toISOString();

/** Valid, empty Statsig initialize payload — every gate resolves to "off". */
const statsigBootstrapPayload = (stableId = "codex-web-local") => ({
  has_updates: true,
  hash_used: "djb2",
  time: Date.now(),
  feature_gates: {},
  dynamic_configs: {},
  layer_configs: {},
  param_stores: {},
  user: {
    userID: null,
    email: null,
    custom: { auth_method: null },
    customIDs: { stableID: stableId, WebAnonymousCookieID: stableId, DeviceId: stableId },
  },
});

/** A remote-catalog plugin descriptor the renderer can render without data. */
const mockRemotePluginRead = (pluginName) => ({
  plugin: {
    summary: {
      id: pluginName,
      name: String(pluginName).replace(/^plugin_[^_]*_/, ""),
      remotePluginId: pluginName,
      version: null,
      installed: false,
      enabled: false,
      installPolicy: "NOT_AVAILABLE",
      installPolicySource: null,
      mustShowInstallationInterstitial: false,
      authPolicy: "ON_USE",
      availability: "NOT_AVAILABLE",
      disabledReason: "unavailable_offline",
      interface: {
        displayName: pluginName,
        shortDescription: "Cloud plugin (offline build)",
        longDescription: "This plugin belongs to the ChatGPT cloud catalog and is not available in a fully local build.",
        developerName: null,
        category: null,
        capabilities: [],
        websiteUrl: null,
        privacyPolicyUrl: null,
        termsOfServiceUrl: null,
        defaultPrompt: [],
        brandColor: "#6B7280",
        composerIcon: null,
        composerIconUrl: null,
        logo: null,
        logoDark: null,
        logoUrl: null,
        logoUrlDark: null,
        screenshots: [],
        screenshotUrls: [],
      },
      keywords: [],
    },
    skills: [],
    onboardingSkill: null,
  },
});

const serveMock = (req, res, urlPath) => {
  let search = "";
  try {
    search = new URL(req.url, "http://localhost").search;
  } catch {
    /* keep empty */
  }
  MOCK_LOG.push(`${req.method} ${urlPath}${search}`);
  if (MOCK_LOG.length > 200) MOCK_LOG.shift();

  const json = (obj, status = 200) => {
    res.writeHead(status, { "content-type": MIME[".json"], "cache-control": "no-store" });
    res.end(JSON.stringify(obj));
  };
  const p = urlPath.replace(/^\/mock/, "") || "/";

  // Cloud MCP endpoint (ChatGPT-hosted app connectors). Answer 404 so the app
  // server marks these connectors unavailable immediately — with a semantically
  // empty 200 it would retry and block thread startup on MCP enumeration.
  if (/^\/api\/codex\/ps\/mcp/.test(p)) {
    res.writeHead(404, { "content-type": MIME[".json"], "cache-control": "no-store" });
    res.end(JSON.stringify({ error: { message: "cloud connectors are unavailable in a local build" } }));
    return;
  }

  // ---- known wham (ChatGPT backend) shapes -------------------------------
  // Cloud tasks: the renderer dereferences `.items` and paginates on `.cursor`.
  if (/^\/wham\/tasks\/list/.test(p)) {
    json({ items: [], cursor: null });
    return;
  }
  // Statsig bootstrap: `{ statsigPayload: <string> }`, exactly as the desktop
  // main process hands it over.
  if (/^\/wham\/statsig\/bootstrap/.test(p)) {
    json({ statsigPayload: JSON.stringify(statsigBootstrapPayload()) });
    return;
  }

  // Plugin catalog refresh: the app server persists this under
  // ~/.codex/cache/remote_plugin_catalog. The truthful local answer is an
  // empty catalog — no cloud plugins exist in this build.
  if (/plugin/i.test(p)) {
    json({ schema_version: 1, fetched_at: nowIso(), plugins: [] });
    return;
  }
  // Generic empty-but-valid JSON: callers parse it, find nothing to do, and
  // move on without errors.
  json({});
};

// ------------------------------------------------------- mock model provider
// The model wire lives in ./mock-model.mjs so the local model is defined once
// and every caller gets the identical Responses-API stream.
const logMockRequest = (line) => {
  MOCK_LOG.push(line);
  if (MOCK_LOG.length > 200) MOCK_LOG.shift();
};

// ------------------------------------------------------------------- server
// Read-only git ops accepted by POST /__codex_git (A7). Anything else is
// rejected; there is intentionally no write op in this set.
const GIT_OPS = new Set(["stable-metadata", "branch", "status"]);

const readJsonBody = (req) =>
  new Promise((resolve, reject) => {
    let raw = "";
    req.setEncoding("utf8");
    req.on("data", (c) => {
      raw += c;
      if (raw.length > 4_000_000) reject(new Error("body too large"));
    });
    req.on("end", () => {
      try {
        resolve(raw ? JSON.parse(raw) : {});
      } catch (err) {
        reject(err);
      }
    });
    req.on("error", reject);
  });

const server = http.createServer(async (req, res) => {
  let urlPath;
  try {
    urlPath = decodeURIComponent(new URL(req.url, "http://localhost").pathname);
  } catch {
    res.writeHead(400).end("bad request");
    return;
  }

  if (urlPath === "/__codex_shim.js") {
    res.writeHead(200, { "content-type": MIME[".js"], "cache-control": "no-store" });
    res.end(SHIM);
    return;
  }

  if (urlPath === "/__codex_local_host.js") {
    res.writeHead(200, { "content-type": MIME[".js"], "cache-control": "no-store" });
    res.end(LOCAL_HOST_JS);
    return;
  }

  // Filesystem work the Electron main process would do: allocate a directory for
  // a conversation that is not attached to a project.
  if (urlPath === "/__codex_projectless") {
    if (req.method !== "POST") {
      res.writeHead(405).end("method not allowed");
      return;
    }
    try {
      const { op, args } = await readJsonBody(req);
      const result = op === "readWorkspaceRoot" ? readWorkspaceRoot() : createProjectlessPaths(args ?? {});
      res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
      res.end(JSON.stringify({ result }));
    } catch (err) {
      res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
      res.end(JSON.stringify({ error: { message: err?.message ?? "workspace error" } }));
    }
    return;
  }

  // Read-only git (A7). The renderer gates the composer on
  // `git.request("stable-metadata")`, which the desktop main process answers.
  // Only three read-only ops are accepted; write operations cannot be
  // expressed, and no caller-supplied path ever reaches argv — `cwd` is
  // passed to execFile as the working-directory option only, and every git
  // invocation runs strictly inside that directory. A missing cwd or a
  // non-repository cwd gets a structured error, not a silent stub.
  if (urlPath === "/__codex_git") {
    if (req.method !== "POST") {
      res.writeHead(405).end("method not allowed");
      return;
    }
    const gitError = (message) => {
      res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
      res.end(JSON.stringify({ error: { message } }));
    };
    try {
      const { op, cwd } = await readJsonBody(req);
      if (!GIT_OPS.has(op)) {
        gitError(`unsupported git op: ${String(op)}`);
        return;
      }
      if (typeof cwd !== "string" || !cwd) {
        gitError("git request needs a cwd");
        return;
      }
      const dir = path.resolve(cwd);
      let st;
      try {
        st = fs.statSync(dir);
      } catch {
        gitError(`cwd does not exist: ${dir}`);
        return;
      }
      if (!st.isDirectory()) {
        gitError(`cwd is not a directory: ${dir}`);
        return;
      }
      const runGit = (args) => execFileSync("git", args, { cwd: dir, encoding: "utf8", timeout: 10_000 }).trim();
      let toplevel;
      try {
        toplevel = runGit(["rev-parse", "--show-toplevel"]);
      } catch {
        gitError(`not a git repository: ${dir}`);
        return;
      }
      let branch = null;
      try {
        const raw = runGit(["rev-parse", "--abbrev-ref", "HEAD"]);
        branch = raw === "HEAD" ? null : raw; // detached HEAD, or no commits yet
      } catch {
        branch = null;
      }
      let upstream = null;
      try {
        upstream = runGit(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
      } catch {
        /* no upstream configured */
      }
      const porcelain = runGit(["status", "--porcelain=v1"]);
      const clean = porcelain === "";
      // stable-metadata keeps the six fields the old stub returned, now
      // populated for real; branch/status return the subset they need.
      const result =
        op === "branch"
          ? { branch, upstream }
          : op === "status"
            ? { branch, upstream, clean, files: clean ? [] : porcelain.split("\n") }
            : {
                available: true,
                branch,
                upstream,
                repository: toplevel,
                state: clean ? "clean" : "dirty",
                worktree: toplevel,
              };
      res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
      res.end(JSON.stringify({ result }));
    } catch (err) {
      gitError(err?.message ?? "git error");
    }
    return;
  }

  // Diagnostic: what has the app server asked the mock backend for?
  if (urlPath === "/__codex_mocklog") {
    res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
    res.end(JSON.stringify({ requests: MOCK_LOG }));
    return;
  }

  // Statsig bootstrap. The renderer normally POSTs /wham/statsig/bootstrap to
  // the ChatGPT backend; the `statsig-bootstrap-local` patch redirects it here.
  // The response is a valid, empty initialize payload — every gate resolves to
  // "off" and the SDK completes initialization instead of retrying forever.
  if (urlPath === "/__codex_statsig_bootstrap") {
    MOCK_LOG.push(`POST ${urlPath} (statsig bootstrap)`);
    if (MOCK_LOG.length > 200) MOCK_LOG.shift();
    if (req.method !== "POST") {
      res.writeHead(405).end("method not allowed");
      return;
    }
    let body = {};
    try {
      body = await readJsonBody(req);
    } catch {
      /* empty request body is fine */
    }
    const stableId = typeof body.stable_id === "string" ? body.stable_id : "codex-web-local";
    res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
    // The renderer expects `{ statsigPayload: <string> }` — the payload as a
    // JSON string, exactly as the desktop main process hands it over.
    res.end(JSON.stringify({ statsigPayload: JSON.stringify(statsigBootstrapPayload(stableId)) }));
    return;
  }

  // Same-origin Statsig event flush: the renderer posts to /ces/v1/rgstr, which
  // lands here. Accept and drop — nothing is measured, nothing leaves.
  if (urlPath.startsWith("/ces/")) {
    res.writeHead(202, { "content-type": MIME[".json"], "cache-control": "no-store" });
    res.end("{}");
    return;
  }

  // Mock model provider (see ./mock-model.mjs). The app server's
  // model_provider points here, so `turn/start` completions are answered from
  // this process with a well-formed Responses-API SSE stream. Nothing reaches
  // the network and the reply renders exactly as a live model's would.
  if (urlPath === "/mockrelay" || urlPath.startsWith("/mockrelay/")) {
    serveMockRelay(req, res, urlPath, { onRequest: logMockRequest });
    return;
  }

  // Mock ChatGPT backend (see serveMock above).
  if (urlPath === "/mock" || urlPath.startsWith("/mock/")) {
    serveMock(req, res, urlPath);
    return;
  }

  // Event stream. Everything the app server emits on its own initiative —
  // streaming deltas, turn progress, server-initiated approval requests — comes
  // back through here. Long-polled so the renderer stays in step without a
  // websocket.
  if (urlPath === "/__codex_events") {
    try {
      await bridge.ensure();
      const messages = await bridge.waitForNotifications(15_000);
      res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
      res.end(JSON.stringify({ events: messages }));
    } catch (err) {
      res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
      res.end(JSON.stringify({ events: [], error: String(err?.message ?? err) }));
    }
    return;
  }

  // Local JSON-RPC passthrough to the real codex app server.
  if (urlPath === "/__codex_rpc") {
    if (req.method !== "POST") {
      res.writeHead(405).end("method not allowed");
      return;
    }
    let method, params;
    try {
      ({ method, params } = await readJsonBody(req));
      if (typeof method !== "string") {
        res.writeHead(400, { "content-type": MIME[".json"] }).end('{"error":{"message":"missing method"}}');
        return;
      }
      // The desktop main process strips `originator` filtering before it
      // forwards `thread/list` to the app server — a local app-server rejects
      // the parameter with -32602. Mirror the sanitisation here.
      if (method === "thread/list" && params && typeof params === "object") {
        const strip = (obj) => {
          if (!obj || typeof obj !== "object") return;
          for (const key of Object.keys(obj)) {
            if (key === "originator" || key === "originators") delete obj[key];
            else if (obj[key] && typeof obj[key] === "object") strip(obj[key]);
          }
        };
        strip(params);
      }
      await bridge.ensure();
      const result = await bridge.request(method, params);
      res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
      res.end(JSON.stringify({ result: result ?? null }));
    } catch (err) {
      // A cloud-catalog plugin cannot be fetched in a local build; answer with
      // a well-formed offline descriptor instead of an error the renderer
      // would surface as a toast.
      if (method === "plugin/read" && params && typeof params.pluginName === "string") {
        res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
        res.end(JSON.stringify({ result: mockRemotePluginRead(params.pluginName) }));
        return;
      }
      const message = err?.rpc?.message ?? err?.message ?? "rpc failed";
      res.writeHead(200, { "content-type": MIME[".json"], "cache-control": "no-store" });
      res.end(JSON.stringify({ error: { code: err?.rpc?.code ?? -32000, message } }));
    }
    return;
  }

  const rel = urlPath === "/" ? "index.html" : urlPath.replace(/^\/+/, "");
  const abs = path.join(ROOT, rel);

  if (!abs.startsWith(ROOT)) {
    res.writeHead(403).end("forbidden");
    return;
  }

  let file = abs;
  if (!fs.existsSync(file) || fs.statSync(file).isDirectory()) {
    file = path.join(ROOT, "index.html"); // SPA fallback
    if (!fs.existsSync(file)) {
      res.writeHead(404).end("not found");
      return;
    }
  }

  const ext = path.extname(file).toLowerCase();
  const type = MIME[ext] || "application/octet-stream";

  try {
    let body = fs.readFileSync(file);
    let patched = null;

    if (ext === ".html") {
      body = Buffer.from(patchHtml(body.toString("utf8")), "utf8");
    } else if (ext === ".js") {
      const { out, applied } = patchJs(body.toString("utf8"));
      if (applied.length) {
        body = Buffer.from(out, "utf8");
        patched = applied.join(",");
      }
    }

    res.writeHead(200, {
      "content-type": type,
      "cache-control": "no-store",
      ...(patched ? { "x-codex-patched": patched } : {}),
    });
    res.end(body);
  } catch (err) {
    console.error("[web] read error", file, err.message);
    res.writeHead(500).end("read error");
  }
});

server.listen(PORT, "127.0.0.1", () => {
  console.log(`[web] Codex webview served from ${ROOT}`);
  console.log(`[web] http://127.0.0.1:${PORT}/`);
  console.log(`[web] app server: ${bridge.binary ?? "not found"}`);
  console.log(`[web] workspace root: ${WORKSPACE_ROOT}`);
  console.log(`[web] mock backend: http://127.0.0.1:${PORT}/mock`);
});

// A long-running local host must survive its own bugs: log loudly, keep
// serving. Without this one bad request would take the whole app down.
process.on("uncaughtException", (err) => {
  console.error("[web] uncaught:", err?.stack ?? err);
});
process.on("unhandledRejection", (err) => {
  console.error("[web] unhandled rejection:", err?.stack ?? err);
});